@gotcos/glasses-server 6.36.18 → 6.36.20

package/CHANGELOG.md

@@ -1,3 +1,66 @@
+## 6.36.20
+
+Follow-up to 6.36.19, which was never published. QA found three things in it.
+
+**The reset CLI mutated production archives just by importing.**
+`message-era-reset.ts` imported `endSession`/`getActiveSessions` from
+`conversation.js` and used neither -- but that module's scope runs
+`loadFromDisk()` and a boot `runDailyArchiveMirror()`. In the one-shot CLI that
+is a second process concurrently loading and rewriting the archives the live
+server owns, and `appendToArchive` appends rather than upserts, so it can
+duplicate prior-day chats. The import is gone, and a test now asserts it stays
+gone. The previous canary injected an `archiveAndRelease` and asserted it was
+never called, which only ever caught a regression routed through the callback --
+the code it replaced called `endSession()` directly as its default. `sessions`
+and `archiveAndRelease` are deleted from the input type rather than left as a
+silent no-op for a future caller.
+
+**A corrupt `message-era.json` was indistinguishable from a reset.**
+`currentMessageEraState` fell back to `legacy` on missing OR invalid content.
+Reverting to `legacy` after a real era existed is the worst available answer: it
+re-reads every era-stamped exchange as a PREVIOUS era, hiding it from
+`/all-messages`, while promoting unstamped ones to current -- and to a client it
+looks exactly like a reset nobody asked for. Missing still means `legacy`, which
+is correct for a first upgrade whose exchanges carry no stamp at all. Corrupt
+now rotates explicitly, says so on stderr, and degrades to `legacy` without
+caching only if the replacement cannot be persisted.
+
+**The header described a code path that had been removed.** It still said
+rotation stops "if an archive write fails". There is no archive write. It now
+also records what 6.36.19 quietly changed: this path does NOT archive, and the
+daily mirror skips today by design, so a same-day copy exists only after an
+explicit session end or `POST /api/archive/now`.
+
+The 409 copy on both query paths no longer tells the wearer to reopen for a
+"fresh message list" -- as of app 6.8.423 the cards stay.
+
+Requires app 6.8.423. Suite 2985 / 211 files, tsc 0. The conversation-import
+canary is mutation-verified: reintroducing the import fails it.
+
+## 6.36.19
+- **Resetting the spoken message count no longer ends the conversation.**
+  `resetLiveMessageEra` used to `endSession` every live session before rotating
+  the era, so "reset the message count" also emptied CHAT and killed the thread
+  the wearer was in the middle of. It now rotates the era and nothing else.
+- Numbers stay unique because they were never bare ints: a number is
+  `{messageEra, globalMsgNum}`. The era rotates, the current-era ceiling
+  restarts at 0, and leftover cards keep their old era and their old number.
+  Lookup already prefers the current era (`message-ref.ts:231-234`) and the
+  counter is already era-scoped (`message-ref.ts:242-251`), so "message N" stays
+  unambiguous without a second ID scheme.
+- `archived` stays in the response and is now always `0`. Callers read the field,
+  so it is kept — but copy that reports it must stop claiming sessions were
+  archived. The `archive_failed` 503 path is **gone**, not relocated: there is no
+  archive step left to fail.
+- Tests inverted to match. A supplied `archiveAndRelease` is now asserted
+  *never to be called*, and a refusing one can no longer block the rotation.
+  Mutation-verified: reintroducing the release loop fails the suite.
+
+**Ship gate:** do not POST `/api/message-era/reset` from any surface until app
+6.8.422 is also live. Server-first plus the old companion still wipes local
+messages, and `/sessions/today/all-messages` is era-filtered so recover cannot
+bring the leftover cards back.
+
 ## 6.36.18
 - **Meetings list now carries voice-assignment tags.** Each row includes
   `voiceReview` from the sidecar head (`speakers[]`) plus whether a human

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.36.18",
+  "version": "6.36.20",
   "description": "COS Glasses — self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
   "type": "module",
   "bin": {

package/server/lib/message-era-reset.ts

@@ -1,15 +1,23 @@
-// Archive live sessions, then start short-numbering at #1.
-// History is retained in day archives; only the current era's ceiling resets.
-// Disk mtime on message-era.json is enough — the live server re-reads it.
-// Do not rotate the era if a query is in flight or an archive write fails.
-
-import { endSession, getActiveSessions } from './conversation.js'
+// Rotate the short-number namespace. Live sessions are NOT ended and nothing
+// is archived here: the companion keeps every card, so the reset is a numbering
+// change rather than a history change.
+//
+// Do not rotate the era if a query is in flight.
+//
+// NOTE: this file deliberately imports nothing from ./conversation.js. Importing
+// it runs its module scope -- loadFromDisk() and a boot runDailyArchiveMirror()
+// -- which in the one-shot CLI means a second process concurrently loading and
+// rewriting the same archives the live server owns. appendToArchive appends
+// rather than upserts, so that duplicates prior-day chats.
+//
+// Today's exchanges are NOT archived by this path. The daily mirror skips
+// today by design (conversation.ts: `sessionDay >= todayLocal`), so a same-day
+// copy exists only after an explicit session end or POST /api/archive/now.
 import {
   createMessageEra,
   currentMessageEraState,
   type MessageEraState,
 } from './message-era.js'
-import type { SessionToArchive } from './archive.js'
 
 export class MessageEraResetError extends Error {
   readonly code: string
@@ -37,8 +45,6 @@ export interface MessageEraResetInput {
   now?: number
   activeRuns?: number
   shuttingDown?: boolean
-  sessions?: SessionToArchive[]
-  archiveAndRelease?: (session: SessionToArchive) => Promise<boolean>
 }
 
 async function resolveJobHealth(input: MessageEraResetInput): Promise<{ activeRuns: number; shuttingDown: boolean }> {
@@ -79,26 +85,29 @@ export async function resetLiveMessageEra(input: MessageEraResetInput): Promise<
   }
 
   const previous = currentMessageEraState()
-  const sessions = input.sessions ?? getActiveSessions()
-  const archiveAndRelease = input.archiveAndRelease ?? (async (session: SessionToArchive) => {
-    const result = await endSession(session.id)
-    if (!result) return true
-    if (result.exchangeCount > 0 && !result.logged) return false
-    return true
-  })
 
-  let archived = 0
-  for (const session of sessions) {
-    const released = await archiveAndRelease(session)
-    if (!released) {
-      throw new MessageEraResetError(
-        'archive_failed',
-        'Archive failed; message count was not reset.',
-        503,
-      )
-    }
-    archived++
-  }
+  // 6.36.19 — rotate the era, do NOT end the thread.
+  //
+  // This used to endSession() every live session before rotating, which is what
+  // made "reset the message count" also empty CHAT and kill the conversation the
+  // wearer was in the middle of. Miles wants the opposite shape: the next message
+  // is #1, the old cards keep their numbers, and the thread survives.
+  //
+  // Numbers stay unique because they are {messageEra, globalMsgNum}, not a bare
+  // int: the era rotates, the current-era ceiling restarts at 0, and leftover
+  // cards keep their old era. Lookup already prefers the current era
+  // (message-ref.ts:231-234) and the counter is already era-scoped
+  // (message-ref.ts:242-251), so nothing downstream needs to change to keep
+  // "message N" unambiguous.
+  //
+  // `archived` stays in the result and is now always 0. Control and the app read
+  // it, so removing the field would break them; the copy that reports it has to
+  // stop claiming sessions were archived.
+  //
+  // Deliberately no archive step here. There is nothing to release, so there is
+  // no 503 archive_failed path any more — that failure mode is gone rather than
+  // relocated. The day-archive mirror already retains history.
+  const archived = 0
 
   const next: MessageEraState = createMessageEra(input.now ?? Date.now())
   return {

package/server/lib/message-era.ts

@@ -55,9 +55,38 @@ export function currentMessageEraState(): MessageEraState {
     cachedMtimeMs = mtimeMs
     return cached
   }
-  cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
-  cachedMtimeMs = mtimeMs
-  return cached
+  // Missing is not corrupt. A legacy install upgrading for the first time has
+  // no file AND no era stamps on its exchanges, and only LEGACY_MESSAGE_ERA
+  // classifies an unstamped exchange as current. Rotating here would file every
+  // one of them under a previous era and empty the chat on upgrade.
+  if (loaded.status === 'missing') {
+    cached = { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+    cachedMtimeMs = mtimeMs
+    return cached
+  }
+
+  // Corrupt, or present-but-invalid: the file existed, so a real era almost
+  // certainly did too, and its value is now unrecoverable. Reverting to legacy
+  // would be the worst available answer -- it re-reads every era-stamped
+  // exchange as a PREVIOUS era (hiding it from /all-messages) while promoting
+  // unstamped ones to current, and it is indistinguishable from a reset nobody
+  // asked for. Rotate explicitly and say so, so the state is self-consistent
+  // and the event is diagnosable.
+  console.error(
+    `[message-era] ${MESSAGE_ERA_FILE} was unreadable (status=${loaded.status}); `
+    + 'rotating to a fresh era. Older messages stay in day archives and remain '
+    + 'reachable by session, but not by short number.',
+  )
+  try {
+    return createMessageEra()
+  } catch (err) {
+    // Read-only or full data dir: degrade to legacy rather than crash the
+    // server, but never cache it -- the next call retries the rotation.
+    console.error('[message-era] could not persist the replacement era:', err)
+    cached = null
+    cachedMtimeMs = Number.NaN
+    return { v: 1, era: LEGACY_MESSAGE_ERA, startedAt: 0 }
+  }
 }
 
 export function currentMessageEra(): string {

package/server/lib/query-job-runtime.ts

@@ -82,7 +82,7 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
     throw new QueryJobAdmissionPreparationError(
       409,
       'message_era_mismatch',
-      'Reopen or update COS Glasses to start the fresh message list.',
+      'Reopen or update COS Glasses. Your cards stay; the next message is #1.',
     )
   }
   try {

package/server/routes/query.ts

@@ -60,7 +60,7 @@ queryRouter.post('/query', async (req, res) => {
     maintenanceLease.release()
     return res.status(409).json({
       error: 'message_era_mismatch',
-      detail: 'Reopen or update COS Glasses to start the fresh message list.',
+      detail: 'Reopen or update COS Glasses. Your cards stay; the next message is #1.',
       era: activeMessageEra,
     })
   }

package/server/scripts/reset-message-era.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env tsx
-// Archives live sessions, then creates a fresh short-number namespace.
-// History stays in day archives. Disk mtime is enough — no server restart.
+// Creates a fresh short-number namespace. Live sessions are NOT ended and
+// nothing is archived -- the companion keeps every card. Disk mtime is enough
+// — no server restart.
 //
 //   npx tsx server/scripts/reset-message-era.ts --confirm
 
@@ -22,7 +23,7 @@ console.log(JSON.stringify({
   restartRequired: false,
   verify: 'GET /api/message-counter should return { max: 0, era: "<era above>" }',
   nextSteps: [
-    'Phone: tap RESET # or reopen the companion so the live list clears',
+    'Phone: reopen the companion — cards stay, the next message is #1',
     'Send a test message — expect #1',
   ],
 }, null, 2))